AWS EBS Volume not encrypted using Customer Managed Key misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_189
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

Amazon EBS automatically creates a unique AWS managed key in each Region where you store AWS resources. This KMS key has the alias alias/aws/ebs. By default, Amazon EBS uses this KMS key for encryption. Alternatively, you can specify a symmetric customer managed key that you created as the default KMS key for EBS encryption. Using your own KMS key gives you more flexibility, including the ability to create, rotate, and disable KMS keys.

How to Fix

Resource: aws_ebs_volume

• Attribute: kms_key_id - (Optional) The ARN for the KMS encryption key. When specifying kms_key_id, encrypted needs to be set to true.

NOTE: Terraform must be running with credentials which have the GenerateDataKeyWithoutPlaintext permission on the specified KMS key as required by the EBS KMS CMK volume provisioning process to prevent a volume from being created and almost immediately deleted. [source,go]

resource "aws_ebs_volume" "example" { availability_zone = "us-west-2a" size = 40

• kms_key_id = "ckv_kms" tags = { Name = "HelloWorld" } }

---